This page collects what you need in order to run the openXEdge safely: where to report a security problem, how long you get updates, what to do at commissioning and decommissioning, which network ports are open, and what data the device processes.
Reporting a vulnerability
If something about the openXEdge looks like a security problem, please report it to:
Anything that helps us reproduce it is useful: the firmware version (Settings → Update), the machine ID, what you did and what happened.
Our commitment. Anyone who reports a vulnerability to us in good faith has no legal action to fear from us. We confirm receipt, keep you posted, and credit you when we close the gap if you want us to. Please give us time to fix the problem before you publish the details.
You can hold us to this:
- You receive an acknowledgement within 5 working days.
- Within 15 working days we tell you whether the openXEdge is affected, how severe we rate the vulnerability and how we intend to proceed.
- Please publish details no earlier than 90 days after your report or once the fix has shipped, whichever comes first.
If you suspect a vulnerability is already being exploited, say so explicitly — shorter deadlines apply to those.
How long you get security updates
Brinkhaus provides security updates for the openXEdge firmware and the container stack shipped with it through the signed update channel for five years from the delivery of the individual device.
In detail:
- The period starts when your device is delivered, not when the product was launched. Two devices can therefore have different end dates.
- If a device is replaced, the replacement starts a period of its own.
- It covers the firmware and the services shipped with it.
- The commitment applies to every firmware release of this stream.
How security updates reach the device
Security updates arrive the same way as any firmware update: you pick a version in the settings, the edge downloads it from the Brinkhaus update server and verifies its digital signature before installing. If the signature does not match, nothing is installed. If the installation fails, the edge returns to the previous state by itself.
How updates work describes the sequence in detail. If your edge cannot reach the update server, there is also the USB route — with the same signature check.
We mark security-relevant changes in the release notes, which you can read before installing.
Secure commissioning
Two things are worth doing right away:
- Change the initial password. Every edge ships with its own initial password derived from its machine ID, so it is not the same across the fleet. But it is not a secret either: anyone who knows the method and the machine ID can work it out. Change it when you first sign in — the edge does not force you to. → Change password
- Create individual user accounts instead of sharing one. Only then does the audit trail tell you afterwards who changed what. Every password someone sets must meet the password policy (in the GMN stream from gmn-2.45.2), by default at least 10 characters. An admin can tighten it there. → Manage users
Beyond that, safe operation assumes the edge sits in a protected company or plant network and is not reachable from the internet. Do not set up port forwarding to the device. For remote access, use the encrypted route.
Secure decommissioning
When a device is retired, returned or passed on:
- Erase the data. All recorded measurements, settings and credentials live on the built-in disk. Reinstalling from a USB stick writes a complete image to that disk and overwrites it in the process. If the medium has to be erased verifiably and without residue — when returning it to a third party, for instance — that is not enough; plan for a full overwrite or physical destruction of the medium. We will help you with that.
- Check your own integrations. If you wired the edge into your own systems, remove those entries.
Open network ports
These ports are reachable from outside in the delivered state. Every other service — database, DataStore, update service — is reachable only inside the device and cannot be addressed from outside. A firewall on the device enforces this: it drops every connection to a port that is not on the allow-list. You may close the system ports 22, 5000 and 5443 yourself and open further ports yourself — see Configure the firewall.
Your product functions
| Port | Purpose | Note |
|---|---|---|
| 5000/tcp | Operator interface, unencrypted | The kiosk screen uses it too |
| 5443/tcp | Operator interface, encrypted | The recommended route; the certificate is self-issued. GMN and Brinkhaus streams only |
| 8050/tcp | IDEA-4S bridge | Blocked from the network by the firewall; meant for the applications on the device. The service additionally decides who may read and who may write, by source address. GMN stream only |
| 8082/tcp | IO-Link relay | Blocked from the network by the firewall until you open it by rule for a DataStore outside the edge; the relay additionally checks the source address against its allow list. GMN stream only |
| 1883/tcp | MQTT broker | No authentication, no encryption. Anyone who reaches this port can read every measurement and inject their own. The interface is deliberately open so your own systems can subscribe — which is exactly why it belongs in a protected network. GMN stream only |
| 8080/tcp | DeepLight | HSH stream only |
Base system services
| Port | Purpose |
|---|---|
| 22/tcp | Maintenance access for Brinkhaus, key-based login only |
These base-system services run on the device but are blocked from outside by the firewall; they are needed only inside the device:
| Port | Purpose |
|---|---|
| 80, 443/tcp | The AppStore’s distributor to the installed applications — the operator interface embeds the AppStore through its own port. GMN stream only |
| 8951/tcp | AppStore service. GMN stream only |
| 8085/tcp | Self-diagnosis of the security agent, read by the operator interface. GMN stream only |
| 631/tcp | Print service. It comes along as a dependency of the kiosk browser and is not needed to run the edge |
What data the edge processes
On the device are the measurements from your sensors and machines, the settings, and the user accounts of the operator interface. You decide yourself how long measurements are kept.
To Brinkhaus fleet management the device, like every openXEdge, tries to send operating data: version levels, IP addresses, heartbeats and self-diagnosis codes. At the factory it has no access for this, so fleet management does not accept the data. No sensor measurements, no process data, no personal data. The connection always goes out from the edge; no port is opened from outside.
What the product is, and what it is protected against
The openXEdge is a device for condition monitoring of production machines: it records sensor and process values, stores them and displays them. It does not control the machine and is not part of a safety chain.
We protect four things, in this order of precedence:
- Recording keeps running — even when the network fails, a plug is pulled or a service crashes.
- Only our software reaches the device — every update is signed and verified before installation.
- Credentials stay on the device.
- Interventions are traceable — sign-ins, sign-outs and changes are logged.
Where availability and hardening conflict, availability wins: a device that stops measuring is of no use on a shop floor. Those trade-offs are written down and justified.
Software bill of materials (SBOM). For every released version we keep a complete list of the software components it contains, in CycloneDX format. You can have it on request to security@brinkhaus-gmbh.de within ten working days; please quote your device’s firmware version.
Declaration of conformity. The supplier declaration for your device is a separate, printable page in this documentation. We provide the full EU declaration of conformity and the technical documentation on request.